Apache Sling App CMS vulnerable to Cross-site Scripting

MEDIO 5.4CVE-2022-43670 · GHSA-jj93-4jr5-x45h · Published 02/11/2022 · updated 17/06/2026

In breve

CVE-2022-43670 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda org.apache.sling:org.apache.sling.cms, sling cms (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.3% delle vulnerabilità.
Correzione: aggiornare a 1.1.2 o successiva.

Package	Affected versions	Patched versions
org.apache.sling:org.apache.sling.cms Maven	`< 1.1.2`	`1.1.2`
sling cms apache	`≤ 1.1.0`	No fix yet

Description

A Cross-site Scripting vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.

NVD description

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.

References

nvd.nist.gov/vuln/detail/CVE-2022-43670 · ADVISORY
apache/sling-org-apache-sling-app-cms · PACKAGE
lists.apache.org/thread/o68l3l3crfxz107fr9dm74y8vg8kj2cs · WEB
openwall.com/lists/oss-security/2022/11/02/8 · WEB

Altre vulnerabilità di org.apache.sling:org.apache.sling.cms

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.sling:org.apache.sling.cms

Maven

< 1.1.2

1.1.2

sling cms

apache

≤ 1.1.0

No fix yet

Description

NVD description

Altre vulnerabilità di org.apache.sling:org.apache.sling.cms

Vedi tutto →